Secure Your Reseller Account: Two-Step Verification, PIN and Device Control

A reseller account holds real money and can move it in seconds. These steps take about ten minutes and remove most of the risk.

1. Turn on two-step verification

With it on, a stolen password alone is not enough — a code from your phone is also required. Three options are usually available:

• Authenticator app. The strongest. Works with no signal and cannot be intercepted.
• SMS. Convenient, weaker. SIM swap attacks target exactly this.
• Email. Only as strong as your email account.

Choose the authenticator app if you can. Google Authenticator, Authy and Microsoft Authenticator all work.

Save the setup key

When you scan the QR code you are also shown a text key. Write it down and keep it somewhere safe. If you lose the phone without it, only an administrator can get you back in.

2. Use a PIN nobody can guess

Your PIN authorises transfers and profile changes. It is separate from your password for a reason — use a different value.

Avoid: 1234, 1111, your birth year, the last four digits of your phone number. These are the first things anyone tries.

3. Check your device log

Your panel lists every device that has signed in, with IP address, browser and time. Look at it monthly. Anything you do not recognise — an unfamiliar city, a browser you never use, a sign-in at 3am — block it and change your password immediately.

4. Read the access log

Every sign-in is recorded. Repeated attempts from an address you do not know mean somebody is trying your password. Change it before they succeed.

5. Lock down API access

If you use the API, whitelist only the server addresses that need it. A key restricted to your own IP is close to worthless if stolen.

What no legitimate service will ever ask for

• Your PIN or password — not support, not your upline, not a phone call
• Your authenticator code — it is valid for thirty seconds and is only for you
• Remote access to your phone to "fix" your account

Every one of these is a scam, without exception. Someone claiming to be from support and asking for a code is stealing your account while you read it out.

If you think you have been compromised

1. Change your password immediately
2. Change your PIN
3. Block every device you do not recognise
4. Reset your API key
5. Tell your upline and support, with times and amounts

Speed matters more than certainty. Act first, investigate afterwards.